Terms of use

• Cyberact, Business ID 3493670-4, VAT number FI34936704
• Email: support@cyberact.io

Access to Cyberact is sold as a subscription, billed every month or every 12 months, at the prices on the pricing page (cyberact.io/pricing) when you subscribe. The subscription renews automatically at the end of each billing period, and the next period is charged to the same payment method, until you cancel it.

A new customer's 12-month subscription starts with a 14-day free trial. A card is required, but nothing is charged until the trial ends: the first charge, the 12-month price, is made when the trial ends. If you cancel during the trial on the billing page, nothing is charged and your access ends when the trial ends. There is one trial per buyer: if you have had a Cyberact subscription or purchase before, there is no trial and the first payment is charged at once. The 1-month term has no trial.

You can cancel any time from the billing page (app.cyberact.io/_gate/billing). A company's subscription is cancelled by the organisation's main administrator. Cancelling stops the renewal: your access continues to the end of the paid period, nothing more is charged, and after that you are on the free plan. A started billing period is not refunded, except where the law requires it. The same page is where you change your payment method and see your invoices.

You change your billing period on the billing page. Moving from monthly to 12-month billing takes effect at once: the 12-month price is charged now, and the unused part of the current month is credited on the same invoice. Moving from 12-month to monthly billing takes effect at the end of the paid year, after which the subscription is billed monthly; you can cancel the switch on the billing page before it takes effect. Switching the billing period is not a new purchase, so no trial comes with it. A company subscription's plan can be changed in the billing portal within the same billing period: a bigger plan takes effect at once and the price difference for the rest of the period is charged straight away, and any credit is deducted from the next invoices. An individual subscription cannot be changed to a company plan on your own: for that, contact support@cyberact.io.

If you have an active personal subscription and join your employer's organisation, your personal subscription is cancelled at once and nothing more is charged for it, as your employer now pays for your access. The invitation page tells you so before you accept, and you get a confirmation by email. The unused part is not refunded automatically.

The 12-month price is the standing price of the 12-month billing period, not a time-limited reduction. Where the site or the checkout compares it with the monthly price, for example as −40%, the comparison is with paying the monthly price for 12 months.

If a renewal payment fails, we tell you by email, and the payment is retried. We may suspend access until the payment is made. If it is not made during the retry period, the subscription ends: a personal account moves to the free plan, and an organisation's data is kept as the privacy notice describes. An amount due for a period that has already started remains payable.

We may change prices for future billing periods. We tell you of a change by email at least 30 days before the new price takes effect, and it applies only from the next renewal. If you do not accept the new price, you can cancel before the renewal. A price change does not affect a period already paid for.

Business plans are priced per organisation with unlimited users and exclude VAT and other taxes, which are added at checkout where they apply. A business customer pays the taxes that apply to its purchase, such as VAT or sales tax, other than taxes on Cyberact's income. The Individual plan is for one person and its price includes VAT.

Payment is taken at checkout by our payment processor, Stripe; we never see your full card details. The contract is made when you confirm the order at checkout, and you receive an order confirmation by email. If the subscription starts with a trial, your card is not charged until the trial ends.

The service starts at once: at your request, access opens as soon as the purchase is confirmed, and you confirm that request at checkout. A consumer who withdraws from the subscription within the withdrawal period therefore pays for the days they had access, as the refund policy explains.

Access is delivered by email: after a purchase you receive an invitation to sign in. A business purchase makes the buyer the organisation's main administrator, who names the organisation and invites its people.

Whoever buys a business plan confirms that they act on behalf of the organisation they buy for and have the authority to bind it, and accepts these terms and the data processing agreement in the organisation's name. The organisation is the customer and is responsible for the payments and for its users. If the buyer had no such authority, the buyer is personally bound by these terms.

The trial, cancelling and the consumer's right of withdrawal are set out in the refund policy (cyberact.io/refund-policy).

Your account is personal: do not give your sign-in code or your access to anyone else. You must be at least 18 to buy the service: the subscriber of the Individual plan must be 18 or over. The service is not intended for children under 16.

A business customer is responsible for the users it adds or invites, for their use of the service, and for having a legal basis for processing their personal data in the service.

We may change, suspend or end the service, or an individual user's access, in particular if these terms are broken or a payment is not made. If we suspend or end access because these terms were broken, the rest of a period already paid for is not refunded, unless mandatory law requires it. If we end the whole service for reasons other than a breach of these terms, we refund the unused part of a period already paid for.

When you use the service, you must not:

• try to reach other users' data or get past the sign-in
• disrupt the service, load it deliberately, or probe it for vulnerabilities without our permission
• use the service for anything unlawful
• share your account or let someone else use it
• use the service if you, or the organisation you act for, are subject to EU, UN or US sanctions or are located in a country under a comprehensive embargo

If you find a security problem, please tell us at support@cyberact.io. We are grateful for every report.

The content of the service — lesson texts, narration, questions, images, software and design — belongs to the service provider or its licensors and is protected by copyright. You may use it for your own training, through the service. You must not:

• copy, save, share, publish or sell the content
• collect the content automatically (scraping, bots, crawlers) or download it in bulk
• use the content to train AI models or to build a competing service
• decompile or reverse-engineer the software, except as far as mandatory law allows

These restrictions are a condition of using the service, and they apply to all of the content, whether or not a given part of it is protected by copyright, for example because it was produced with AI.

The content of the service is produced wholly or partly with artificial intelligence (AI): the lesson texts, questions and explanations, the narration, the images, animations and videos, and the manager console's summaries. The narration voices are synthetic, AI-generated voices, not recordings of real people.

AI can produce errors, omissions and statements that are inaccurate or out of date. Laws, official guidance, threats and technology also change over time, so information that was correct when the content was made may later be incomplete or wrong. We update the content, but we do not promise that every part of it is correct, complete or current at any given moment.

We therefore give no warranty that the content is accurate, complete, up to date or suitable for a particular purpose, and we are not liable for decisions made or actions taken on the basis of it. Check anything important, such as what a law requires of your organisation, against the official sources or with a qualified adviser.

The people, companies, messages and situations in the examples are fictional, unless the content says otherwise. A real company or product named in the content is named only as an example, and its mention is not an endorsement.

We keep the service available and correct it when something is wrong, but we do not promise that it is always available or free of errors, or that its content meets your organisation's particular requirements.

As far as the law allows, the service and its content are provided "as is" and "as available". Apart from what these terms expressly say, we give no warranties or conditions, express or implied, including implied warranties of merchantability, fitness for a particular purpose, title or non-infringement. This does not limit a consumer's statutory rights, such as the rules on digital content that does not conform to the contract.

We are not responsible for a delay or fault caused by force majeure, such as a power or network outage, a failure in a third party's service, an official decision or a cyberattack that reasonable security measures could not have prevented.

The training content is not legal advice, nor an audit or a certificate. Completing it does not on its own show that an organisation meets the requirements of NIS2, the GDPR or any other regulation, and training cannot ensure that people will never be deceived or that a security incident will not happen.

As far as mandatory law allows, we are not liable for indirect, incidental, special or consequential loss, such as lost profit or revenue, loss of data, interruption of business, a fine or sanction imposed by an authority, or loss caused by a fraud, a security incident or a data breach in your organisation. Nor are we liable for loss arising from the content's errors or out-of-date information, or from decisions made on the basis of the content.

Our total liability is limited to the amount you paid for the service in the 12 months before the event that caused the loss. A business customer must make a claim against us in writing within 12 months of when it discovered the loss or should have discovered it.

These limits do not apply to damage caused intentionally or through gross negligence, and they do not restrict the rights a consumer has under mandatory law.

A business customer defends and holds Cyberact harmless against claims by third parties, including its own users and authorities, and pays the resulting damages, costs and reasonable legal fees, to the extent the claim arises from the customer's or its users' breach of these terms, from unlawful use of the service, or from personal data the customer has added to the service without a legal basis. Cyberact tells the customer of such a claim without delay and lets it take part in defending it.

How we process personal data is set out in the privacy notice (https://cyberact.io/privacy).

When an organisation uses the service to train its users, Cyberact processes those users' personal data on the organisation's behalf. For organisation customers, the data processing agreement (https://cyberact.io/dpa) is part of these terms, and it applies from when the organisation buys the service or takes it into use.

We may change these terms, for example when the service, the law or payment methods change. We will tell you about changes by email or in the service at least 30 days before they take effect. If you do not accept a change, you can cancel your subscription before it takes effect. If you keep using the service after the change, you accept the new terms. Changes affecting a consumer must not conflict with mandatory consumer protection law.

These terms, and any dispute arising from them or from the service, are governed by the laws of Finland, without regard to its rules on conflict of laws. The UN Convention on Contracts for the International Sale of Goods (CISG) does not apply.

We will first try to settle any dispute by negotiation. Tell us about the claim in writing at support@cyberact.io. If the dispute has not been resolved within 30 days of that notice, it may be taken further as set out below.

Business customers: disputes are settled exclusively by the District Court of Helsinki, Finland, wherever the customer is based, including the United States. Cyberact may nevertheless bring a claim, such as a claim for unpaid fees, in the courts of the customer's home country. As far as the applicable law allows, a business customer waives the right to a jury trial and brings its claims only individually, not as a plaintiff or class member in a class, collective or representative action.

Consumers in the EU and EEA: a consumer may always bring a claim in the court of their own home municipality or country, and may take the dispute to the Consumer Disputes Board (Kuluttajariitalautakunta) in Finland or to the European Consumer Centre of their own country. If a consumer lives in another EU or EEA country, the choice of Finnish law does not take away the protection of that country's mandatory consumer law.

Consumers outside the EU and EEA, including the United States: disputes are settled by the District Court of Helsinki, unless the mandatory law of your home country or state gives you the right to bring the claim in your own court. As far as that law allows, claims are brought only individually, not as a class, collective or representative action, and the right to a jury trial is waived. Nothing in these terms takes away a right that the mandatory law of your home country or state gives you.

• Whole agreement: these terms, the privacy notice, the refund policy and, for organisation customers, the data processing agreement make up the whole agreement on the service. A business customer's own purchasing or other terms do not apply, even if an order or an invoice refers to them, unless we have agreed to them in writing.
• If a provision of these terms is found invalid or unenforceable, the rest of the terms stay in force, and the provision is applied as far as the law allows.
• If we do not enforce a right at once, we have not waived it.
• We may transfer this agreement to a company that continues the service, for example in a merger or a sale of the business, without weakening a consumer's rights. You may transfer it only with our written consent.
• Notices: we send notices to the email address of the account or of the organisation's main administrator, and you send them to support@cyberact.io.
• These terms are in Finnish and English. If the versions differ, the Finnish version prevails, unless mandatory consumer law requires otherwise.

Questions about these terms: support@cyberact.io.